CVE-2026-87637

CVE-2026-87637 is a use-after-free vulnerability in the Extensions component of Google Chrome on Mac , affecting versions prior to 153.0.8010.36 . A remote attacker could exploit it via a crafted HTML page to execute arbitrary code outside the sandbox . The CNA-assigned CVSS 3.1 score is 9.6 (Cri...

CVE-2026-78974

CVE-2026-78974 is a UI misrepresentation vulnerability in the Linux Toolkit Theming component of Google Chrome prior to 152.0.7977.65 . A remote attacker leveraging social engineering could use a crafted HTML page to bypass system access restrictions . Chromium rates the severity as Low ; the CVS...

CVE-2026-79018

CVE-2026-79018 is an information leak in the FoldableAPIs component of Google Chrome (desktop), affecting versions prior to 152.0.7977.65 . A remote attacker can exploit the vulnerability by serving a crafted HTML page that, when opened by a victim, leaks sensitive information. The attack require...

CVE-2026-79099

CVE-2026-79099 is a missing authorization vulnerability in the Network component of Google Chrome prior to 152.0.7977.65 , allowing a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium rates it Medium severity; the CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:N/UI:R/S:U...

CVE-2026-79106

Google Chrome prior to 152.0.7977.65 contains an improper input validation flaw in the Input component. A remote attacker who has already compromised the renderer process and leverages social engineering can bypass the web origin policy via a crafted HTML page. Red Hat notes this could lead to un...

CVE-2026-79285

CVE-2026-79285 is an uninitialized resource vulnerability in ANGLE , a graphics library component used by Google Chrome on Windows prior to version 152.0.7977.65 . A remote attacker can exploit it by luring a user to visit a crafted HTML page , enabling cross-origin data disclosure (information d...

CVE-2026-87488

A use-after-free vulnerability in the WebGL component of Google Chrome for Android (versions prior to 153.0.8010.36 ) allows a remote attacker to execute arbitrary code outside the sandbox by convincing a user to visit a crafted HTML page. The Chromium project rates this Critical severity; the CV...

CVE-2026-87494

A use after free vulnerability in the Browser component of Google Chrome for Windows (versions prior to 153.0.8010.36 ) allows a remote attacker, leveraging social engineering, to execute arbitrary code outside the sandbox via a crafted HTML page. The vulnerability is rated Medium by Chromium but...

CVE-2026-87544

CVE-2026-87544 affects the Extensions component of Google Chrome prior to version 153.0.8010.36 , where an incorrect authorization flaw allows a remote attacker to bypass system access restrictions into a privileged page using a crafted HTML page. Chromium rated its severity as Low , while the NV...

CVE-2026-87573

CVE-2026-87573 is an improper input validation vulnerability in the Network component of Google Chrome prior to version 153.0.8010.36 . A remote attacker can bypass the web origin policy by serving a crafted HTML page, leading to a low confidentiality impact (no integrity or availability impact p...

CVE-2026-87576

CVE-2026-87576 is an uninitialized resource in the GPU component of Google Chrome on Android , affecting versions prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could exploit this via a crafted HTML page to read memory outside the sandbox . The Chromiu...

CVE-2026-87646

CVE-2026-87646 is a use-after-free vulnerability in Web Authentication in Google Chrome prior to 153.0.8010.36 , allowing a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. The CVSS v3.1 score is 9.6 (CRITICAL) with a changed scope (AV:N/AC:L/PR:N/UI:R/S:C/C:...

CVE-2026-78957

CVE-2026-78957 is an information leak in Google Chrome Mobile on iOS affecting versions prior to 152.0.7977.65 . A local attacker can obtain sensitive information by supplying a crafted file to the browser. Chromium classifies the severity as Low , with a CVSS 3.1 score of 5.5 (Medium) reflecting...

CVE-2026-87474

A use after free vulnerability in the Payments component of Google Chrome prior to version 153.0.8010.36 allows a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium rates the severity as High ; the CVSS 3.1 base score is 9.6 (CRITICAL) with...

CVE-2026-87540

CVE-2026-87540 is an incorrect authorization vulnerability in the Isolated component of Google Chrome , fixed in version 153.0.8010.36 . A remote attacker could deliver a crafted HTML page that causes the browser to spoof UI elements , potentially tricking users into interacting with fraudulent i...

CVE-2026-87430

CVE-2026-87430 is a buffer overflow in the WebRTC component of Google Chrome prior to version 153.0.8010.36 . A remote attacker can potentially execute arbitrary code inside the sandbox by serving a crafted HTML page to the user, requiring user interaction. Chromium assigned a Low security severi...

CVE-2026-78984

CVE-2026-78984 is an uninitialized resource vulnerability in the GPU component of Google Chrome prior to version 152.0.7977.65 . A remote attacker who had already compromised the renderer process could potentially read memory outside the sandbox by serving a crafted HTML page. Chromium rates this...

CVE-2026-87504

CVE-2026-87504 is a use-after-free in the Core component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker leveraging social engineering can execute arbitrary code outside the sandbox via a crafted Chrome extension . Chromium rates the severity as Medium , while the...

CVE-2026-87512

A use after free vulnerability in ANGLE (the Android Native Graphics Library for EGL) in Google Chrome on Windows prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox by convincing a user to visit a crafted HTML page. The Chromium security team rated the ...

CVE-2026-87547

Incorrect reference resolution in the FileSystem component of Google Chrome prior to 153.0.8010.36 allows a remote attacker, leveraging social engineering , to execute arbitrary code outside the sandbox via a crafted HTML page. The CNA-assigned CVSS v3.1 score is 9.6 (Critical) with a network att...

CVE-2026-87500

CVE-2026-87500 is an improper validation of array index in ANGLE , the cross-platform 2D/3D graphics library used by Google Chrome , in versions prior to 153.0.8010.36 . A remote attacker can exploit this via a crafted HTML page to potentially execute arbitrary code outside the Chrome sandbox . T...

CVE-2026-87621

CVE-2026-87621 is an out-of-bounds write in the ANGLE component of Google Chrome on Windows , affecting versions prior to 153.0.8010.36 . A remote attacker could potentially execute arbitrary code outside the sandbox by luring a user into visiting a crafted HTML page. The flaw was rated High by t...

CVE-2026-87654

CVE-2026-87654 is a buffer overflow in ANGLE , the graphics translation layer within Google Chrome on Windows . A remote attacker can execute arbitrary code outside the Chrome sandbox by luring a user to a crafted HTML page. The vulnerability affects Chrome versions prior to 153.0.8010.36 and car...

CVE-2026-87470

CVE-2026-87470 is an improper quantity validation flaw in the Tint component of Google Chrome on Mac prior to 153.0.8010.36 . A remote attacker could execute arbitrary code outside the sandbox by serving a crafted HTML page, requiring user interaction to trigger the exploit. Chromium classifies t...

CVE-2026-87528

A type confusion in Rust in Google Chrome on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium rates the severity as Medium , while the NVD CVSS 3.1 score is 9.6 (CRITICAL) with a network attack vec...

CVE-2026-87542

CVE-2026-87542 is a use-after-free vulnerability in the Input component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page . The vulnerability is rated High severity by Chro...

CVE-2026-87585

CVE-2026-87585 is a double free vulnerability in PDFium within Google Chrome on Windows prior to version 153.0.8010.36 . A remote attacker can potentially execute arbitrary code inside the browser sandbox by delivering a crafted PDF file. The Chromium security severity is rated High with a CVSS 3...

CVE-2026-87634

CVE-2026-87634 is a use-after-free vulnerability in the WebPackaging component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can potentially execute arbitrary code outside the sandbox by delivering a crafted HTML page requiring user interaction. Despite a CVSS 3...

CVE-2026-87650

CVE-2026-87650 is an out-of-bounds read in the WebGL component of Google Chrome versions prior to 153.0.8010.36 , rated CVSS 9.6 (Critical) . A remote attacker can potentially execute arbitrary code outside the sandbox by delivering a crafted HTML page that requires user interaction to load. CISA...

CVE-2026-87489

CVE-2026-87489 is a memory corruption vulnerability in the V8 engine of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can potentially exploit it via a crafted Chrome extension to execute arbitrary code inside the browser sandbox . The CVSS 3.1 score is 8.8 (High) w...

CVE-2026-87499

CVE-2026-87499 is an incorrect authorization flaw in the Network component of Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could use a crafted HTML page to bypass site isolation , escalating their access beyond the intended sandbox boun...

CVE-2026-87520

CVE-2026-87520 is a use-after-free vulnerability in Dawn (Chromium's WebGPU implementation) affecting Google Chrome on Android prior to 153.0.8010.36 . A remote attacker can exploit it via a crafted HTML page to execute arbitrary code outside the sandbox . Chromium rates the security severity as ...

CVE-2026-87529

CVE-2026-87529 is a numeric truncation error in the Media component of Google Chrome prior to 153.0.8010.36 , allowing a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium classifies the severity as Medium , while the CVSS 3.1 score is 9.6 ...

CVE-2026-87558

CVE-2026-87558 is a use-after-free vulnerability in the Payments component of Google Chrome on Mac prior to 153.0.8010.36 . A remote attacker can exploit it via a crafted HTML page to execute arbitrary code outside the sandbox , rated CVSS 9.6 (CRITICAL) . CISA's SSVC assessment indicates no know...

CVE-2026-87578

CVE-2026-87578 is a use-after-free vulnerability in the Receiver component of Google Chrome prior to version 153.0.8010.36 . An adjacent network attacker can exploit it via crafted network traffic to achieve arbitrary code execution outside the Chrome sandbox , with a CVSS 3.1 score of 8.3 (HIGH)...

CVE-2026-87588

CVE-2026-87588 is a use-after-free vulnerability in the Chromecast component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can exploit it via a crafted HTML page to execute arbitrary code inside the sandbox . Chromium rates the security severity as Medium , whil...

CVE-2026-87591

Incorrect authorization in the Extensions component of Google Chrome prior to 153.0.8010.36 allows a remote attacker to bypass system access restrictions via a crafted Chrome extension. The attack requires user interaction but no prior privileges, with a High impact on integrity and no impact on ...

CVE-2026-87613

CVE-2026-87613 is an incorrect reference resolution flaw in the Extensions component of Google Chrome prior to 153.0.8010.36 . A remote attacker could potentially execute arbitrary code outside the sandbox via crafted network traffic. Chromium classifies the severity as Medium , while the CNA-ass...

CVE-2026-87639

A use after free vulnerability in WebPackaging in Google Chrome prior to 153.0.8010.36 allows a remote attacker who has already compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. The Chromium security team rated this High severity. ...

CVE-2026-87648

A use-after-free vulnerability in ANGLE within Google Chrome on Windows (prior to 153.0.8010.36 ) allows a remote attacker who has already compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. The vulnerability requires user interactio...

CVE-2026-87649

CVE-2026-87649 is a UI misrepresentation vulnerability in the Downloads component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker, leveraging social engineering , could use a crafted HTML page to bypass system access restrictions. User interaction is required (the...

CVE-2026-87440

An out-of-bounds read in the Media component of Google Chrome (prior to 153.0.8010.36 ) allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium rates the severity as High , and the assigned CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H...

CVE-2026-87450

Incorrect authorization in the Permissions component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker, leveraging social engineering , to obtain sensitive information via a crafted Chrome extension. The vulnerability is rated Medium by Chromium and 7.5 (HIGH) by NVD (CVSS 3.1: AV...

CVE-2026-87455

A use-after-free vulnerability in the Aura component of Google Chrome prior to 153.0.8010.36 allows a remote attacker, via a crafted HTML page, to potentially execute arbitrary code outside the sandbox. Chromium rated this Medium severity, while the CNA-assigned CVSS 3.1 score is 9.6 (Critical) ,...

CVE-2026-87498

Google Chrome versions prior to 153.0.8010.36 contain a missing authorization flaw in the WebUI component. A remote attacker who had already compromised the renderer process could exploit a crafted HTML page to bypass the web origin policy . Chromium rates the severity as High , while the CNA-ass...

CVE-2026-87533

CVE-2026-87533 is a use after free vulnerability in DevTools within Google Chrome prior to version 153.0.8010.36 . A local attacker can leverage it via a local program to execute arbitrary code outside the sandbox, achieving high impact on confidentiality, integrity, and availability with changed...

CVE-2026-87623

This Medium -severity vulnerability affects the DOM (Document Object Model) in Google Chrome prior to 153.0.8010.36 . An observable discrepancy in the DOM allows a remote attacker, leveraging social engineering , to obtain sensitive information via a crafted HTML page. The CVSS v3.1 score is 6.5 ...

CVE-2026-87633

A use-after-free vulnerability in the Views component of Google Chrome prior to version 153.0.8010.36 allows a local attacker with no prior privileges to execute arbitrary code outside the browser sandbox by inducing UI interaction. The Chromium security team rates the severity as High , with a C...

CVE-2026-87431

CVE-2026-87431 is a missing authorization flaw in the Extensions component of Google Chrome prior to 153.0.8010.36 . A remote attacker can obtain sensitive information by delivering a crafted Chrome extension to a victim. NVD rates the CVSS 3.1 score at 7.5 (High) with a vector of AV:N/AC:L/PR:N/...

CVE-2026-87537

Google Chrome versions prior to 153.0.8010.36 are affected by a missing authorization vulnerability in the Extensions component. A remote attacker who had already compromised the renderer process could potentially execute arbitrary code outside the sandbox via crafted network traffic. The vulnera...